04:49 PM
Connect Directly

Facebook Login Bug: Lessons Learned

Service interruption at dozens of prominent websites including CNN and Hulu reminds that third-party code integration carries risks.

Soltani likens the situation to using giving a speech using the Mad Libs format. You allow a third-party to supply you with words periodically and hope that those words don't alter what you meant to say or embarrass you.

"As a result of a Facebook bug, entire domains were redirected," said Soltani. "That's an incredible amount of power to have."

Facebook presumably isn't going to be introducing similar bugs on a frequent basis. But the online ad industry deals with code trust problems every day.

Websites allow ads to be injected into their webpage code in the same way that many sites allow Facebook Login code to be injected. And in the ad business, the tenuous chain of connections across multiple domains and servers makes trust much more difficult. Cyber criminals routinely attempt to subvert ad network security, through hacking and fraudulent business practices, to distribute malicious code.

Soltani said that combined with other malicious activity such as DNS hijacking, reliance on third-party injected code can be even more of a problem.

There's also the issue of performance. Until December 2009, Google Analytics -- incorporated into many websites -- wasn't asynchronous, meaning that calls to Google's servers made webpages load more slowly. Other widget code inserted into webpages often has a similar effect.

In a blog post last October, Aarron Walter, director of user experience at email marketing service MailChimp, argued that social logins aren't worth it, a position others have taken before him. The social login buttons offered by Facebook and Twitter, he said, put security in someone else's hands and present the risk of brand damage if problems occur.

Moreover, the rationale for implementing social login buttons -- user convenience and ease of use -- might not be justified. Walter found that a 66% decrease in failed logins and a 42% decrease in password resets at Mail Chimp last year were the result of user interface design improvements and better programming, or "better error handling and copywriting" as he put it. Social logins contributed to only 3.4% of the drop in login problems.

Further complicating the question of whether to use a social login is the finding that many companies have implemented Facebook Login ineffectively. Research published by marketing consultancy Social Labs in September 2012 indicates that among the top 500 online retailers, only 30 have implemented a social login -- 77% of these being Facebook Login -- and a fair number of these have done so incorrectly. For example, 30% of the 30 online retailers using a social login require a website password in tandem with a visitor's social username and password, and 15 of these online retailers don't offer a social login during the checkout process, making for an inconsistent user experience. Finally, none of online retailers surveyed have implemented Facebook's login persistence, which automatically logs users in when they return to the website.

Despite these issues, Sociable Labs expects adoption of social logins to increase over time.

2 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/11/2013 | 4:04:36 PM
re: Facebook Login Bug: Lessons Learned
The Mad Libs example is excellent. Is there any indication that this was not just a bug but a hack? Lorna Garey, IW Reports
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio